Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver

W1700K SDR Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it. The whole 2.4 GHz band at 320 Msps, live, with the decimation's roll-off corrected in the stream ("flatten"): a 262,144-point FFT of every sample, 100 spectra a second (this recording runs at 50 frames a second). The MT7996 runs only our own firmware: a ROM patch, WM and WA built from this repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, from MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware, and takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. See docs/architecture.md and docs/roadmap.md. What it does Screenshots 2.4 GHz at 320 Msps, flattened: Wi-Fi frames and shorter hopping bursts on a floor that stays level to the band's edges. The Stream panel shows the link carrying 9.75 Gbit/s, half of the slices packed, and every sample transformed. Two busy 80 MHz Wi-Fi channels at 5170–5330 MHz in a flattened 320 MHz view. Zoomed to 24 MHz around 5250 MHz: the two channels' edges and the guard gap between them, in 1.22 kHz bins. Repository Getting started You need a W1700K, a 3.3 V USB serial adapter on its console header, an Ethernet cable to its lan3 port for installation, and a 10 GbE NIC on the host cabled to its wan port (10GBASE-T; an X710 with a copper SFP+ module works) for the IQ stream. make # everything, from public sources (~10 min plus downloads) make check # the test suite sudo init/host/link up IFACE # 192.168.1.10/24 on the NIC cabled to lan3 sudo init/host/tftp-forward enable IFACE init/install # back up the NAND, install, save the radio calibration sudo init/host/link up IFACE10G 10.77.0.10/24 9216 # the 10 GbE stream link host/stream/build/w1700k-stream & # the stream, for every consumer on this host host/spectrum/build/w1700k-spectrum --controller "host/bin/w1700k serve" --listen 0.0.0.0:8073 Then open http://HOST:8073/ and press ▶. The first start loads the radio firmware and brings the radio up (about 2 s). Without the browser, the same operations are host/bin/w1700k load|start|band|tune|gain|filter|stop|status. Build requirements: a C/C++ compiler, make, git, Python 3.10+, the usual Buildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj (RISC-V firmware), openssl (firmware container encryption), and libfftw3-dev and zlib for the stream service and the spectrum server. No vendor firmware is downloaded or needed. Read before use Our firmware is receive-only. It runs none of MediaTek's transmit calibrations and keeps the MAC's transmit path disabled; a gapless watch at 5250 MHz saw nothing during a load, where MediaTek's firmware transmits a full-power burst. Still, do not cable an antenna port straight into a sensitive instrument without an attenuator. Our ROM patch writes no eFuse. MediaTek's ROM patches since 2025 permanently program one eFuse gate bit on their first run (also with MediaTek's own driver); a unit that ever ran one has that bit set. Installation replaces the stock operating system. init/install first copies the whole NAND to the host; keep that copy. Restoring stock needs a raw NAND writer, which this repository does not provide. Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge the radio until a power cycle. include/hw/ marks every known hazard. Licence MIT, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear). See LICENSE.